ci: add pinned gitleaks secret-scan job (#49)

.github/workflows/validate.yml

@@ -110,3 +110,37 @@ jobs:
 
       - name: Lint workflows
         run: ./actionlint -color .github/workflows/*.yml
+
+  gitleaks:
+    name: Secret scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        env:
+          # gitleaks/gitleaks v8.30.1 linux/x64 release tarball.
+          # SHA256 is the linux_x64 line in gitleaks_8.30.1_checksums.txt
+          # (same digest as the GitHub release asset).
+          GITLEAKS_VERSION: "8.30.1"
+          GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+        run: |
+          set -euo pipefail
+          version="${GITLEAKS_VERSION}"
+          expected="${GITLEAKS_SHA256}"
+          tarball="gitleaks_${version}_linux_x64.tar.gz"
+          checksums="gitleaks_${version}_checksums.txt"
+          base="https://github.com/gitleaks/gitleaks/releases/download/v${version}"
+          curl -fsSL -o "${tarball}" "${base}/${tarball}"
+          curl -fsSL -o "${checksums}" "${base}/${checksums}"
+          grep -qxF "${expected}  ${tarball}" "${checksums}"
+          echo "${expected}  ${tarball}" | sha256sum -c -
+          tar -xzf "${tarball}" gitleaks
+          ./gitleaks version
+
+      - name: Scan for secrets
+        run: ./gitleaks detect --source . --verbose --redact --no-banner